Skip to main content

Payload

The payload structure is an associated data type of all the event variants. Each variant has a specific set of fields, explained in the following lines.

Network

Network related events.

Bind

Generated by OS binding events.

Field nameTypeDescription
addressHostIp and port
is_tcpboolIndicates a TCP connection

Listen

Generated when a process starts to listen for connections.

Field nameTypeDescription
addressHostIp and port

Connect

Generated when a process starts a connection.

Field nameTypeDescription
addressHostIp and port
is_tcpboolIndicates a TCP connection

Accept

Generated when a process accept a connection.

Field nameTypeDescription
sourceHostIp and port of the source
destinationHostIp and port of the destination

Close

Generated by a closed connection.

Field nameTypeDescription
sourceHostIp and port of the source
destinationHostIp and port of the destination

Receive

Generated when a process receive packets.

Field nameTypeDescription
sourceHostIp and port of the source
destinationHostIp and port of the destination
lenusizeLength of the packet
is_tcpboolIndicates a TCP connection

Send

Generated when a process sends packets.

Field nameTypeDescription
sourceHostIp and port of the source
destinationHostIp and port of the destination
lenusizeLength of the packet
is_tcpboolIndicates a TCP connection

DnsQuery

Generated on DNS queries.

Field nameTypeDescription
questionsVec<DnsQuestion>List of DNS questions

DnsResponse

Generated on DNS responses.

Field nameTypeDescription
questionsVec<DnsQuestion>List of DNS questions
answersVec<Vec<DnsAnswer>List of DNS answers

Process

Process related events.

Fork

Genrated on a process fork.

Field nameTypeDescription
ppidi32Parent pid of the process

Exec

Genrated on a process exec.

Field nameTypeDescription
filenameStringPath of the file
argcusizeNumber of arguments passed to the executable
argvVec<String>List of arguments passed to the executable

Exit

Genrated on a process exit.

Field nameTypeDescription
exit_codeu32Exit code of the executable

File system

File system related events.

FileCreated

Generated on file creation.

Field nameTypeDescription
filenameStringPath of the file

FileDeleted

Generated on file deletion.

Field nameTypeDescription
filenameStringPath of the file

DirCreated

Generated on directory creation.

Field nameTypeDescription
dirnameStringPath of the directory

DirDeleted

Generated on directory deletion.

Field nameTypeDescription
dirnameStringPath of the directory

FileOpened

Generated when a process opens a file.

Field nameTypeDescription
filenameStringPath of the file
flagsFileFlagsOpen flags

Generated on symlink creation.

Field nameTypeDescription
sourceStringSource of the link
destinationStringDestination of the link
hard_linkboolIndicates if it's an hard link

FileRename

Generated when a file is renamed.

Field nameTypeDescription
sourceStringSource of the file
destinationStringDestination of the file

ElfOpened

Generated when an executable is opened.

Field nameTypeDescription
filenameStringPath of the file
flagsFileFlagsOpen flags

Threat

Threat related events.

RuleEngineDetection

Generated by the rule engine module on a matched rule.

Field nameTypeDescription
rule_nameStringName of the matched rule
payloadBox<Payload>Original event